Snowflake has publicly denied that its platform was breached, directly contradicting the claim hackers made in a rogue push notification sent to ASOS app users on October 6, 2026, a date that fell squarely inside the company’s own 10.36 server release window, which ran October 3 through 7, 2026, according to Snowflake’s own documentation. The dispute, confirmed by the BBC and Hackread, leaves ASOS customers caught between two conflicting accounts: a threat actor calling itself the Xuanye Group says it “fully compromised” ASOS’s Snowflake instance, while Snowflake says its own investigation “found no compromise” of the platform, a position the company has not walked back, and one it repeated through October 9, 2026, while its 10.37 server release (October 8 to 16, 2026) was completed. For a company already dealing with a 13% share slide and a two-week extortion deadline, the denial adds a second front to the crisis: a fight over whose systems actually failed.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: ASOS App Users Received a “HACKED” Alert
According to the BBC, ASOS app users began receiving an unsolicited push notification on the morning of October 6, 2026, titled “ASOS HACKED.” Hackread reported that the alert carried a link to a Telegram channel and was pushed through ASOS’s own official app, not through email or SMS, which is part of why it spread so quickly among customers who had no reason to distrust a notification coming from an app they had already installed and trusted.
BleepingComputer reported that the message was sent by abusing a third-party platform ASOS uses to communicate with customers, rather than through a public leak site or social media post. That detail matters: it means the attackers didn’t just claim a breach, they demonstrated write access to a customer-facing communication channel, which is a far more visceral proof point for recipients than a forum post ever could be. ASOS has already covered the immediate fallout from that notification, including the 14-day leak deadline attackers set and the resulting 13% drop in ASOS shares. What hasn’t been resolved is a more basic question: was Snowflake actually involved at all.
Snowflake’s Denial Complicates the Story
The notification’s text, as reported by the BBC, read: “Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it.” That single sentence put Snowflake, the cloud data warehouse company that made OpenAI’s GPT-5.6 and GPT-6 Astra models generally available on September 25, 2026, and followed that on September 29, 2026 with a public preview of Anthropic’s Claude Sonnet 5.5, which Snowflake itself billed as Anthropic’s most capable Sonnet model to date, directly in the blast radius of a retailer’s cyber incident for the second time in two years. Snowflake’s response was blunt. A company spokesperson told the BBC: “At this time, we can report that we have found no compromise of the Snowflake platform.”
Snowflake went further in a separate statement reported by Insurance Journal, saying: “We take customer privacy and security very seriously,” and adding that “the investigation is ongoing and we will provide further updates as soon as more information becomes available.” That’s a measured, lawyer-approved line, but it’s also a flat rejection of the attackers’ central claim. Either the hackers are bluffing about where the data came from, or Snowflake’s forensic review hasn’t yet caught up with what actually happened. Neither outcome is good for ASOS, which still has to explain to customers why basic personal information “may have been accessed” regardless of which platform the data traveled through.
Who Is the Xuanye Group?
Hackread described the claimed attacker as a previously unknown entity calling itself the Xuanye Group. That’s a meaningful distinction from the pattern UK retailers have grown used to over the past two years. This is not ShinyHunters, the extortion crew behind the string of breaches tied to Salesforce and Oracle customer data throughout 2026, and it is not the Scattered Spider-linked cluster that UK press tied to the spring 2025 wave of retail attacks. Neither the BBC nor Hackread’s reporting ties Xuanye to any previously catalogued ransomware or extortion brand.
That absence of a track record cuts both ways for ASOS. On one hand, a brand-new name with no leak-site history and no prior victim list gives security researchers nothing to benchmark the threat against, no past behavior to predict whether the group follows through on deadlines or simply disappears once a company refuses to pay. On the other hand, extortion crews routinely rebrand after law enforcement pressure, and a “new” group can simply be a familiar operator wearing a new name to avoid the reputational and legal baggage attached to an old one. Researchers have not confirmed either explanation: on October 21, 2026, the Snowflake-compromise claim remained unproven and no sample data had been released.
Inside the Notification Text
The full wording of the push alert, as captured and reported by the BBC and corroborated by Hackread, is unusually direct for this kind of extortion attempt. It skips the leak-site countdown page entirely and goes straight into the victim’s own app:
Dear ASOS DPO and IT,
we have fully compromised the Snowflake instance.
Engage with us, or we will leak it.Addressing the message to “ASOS DPO and IT” â a direct reference to the company’s Data Protection Officer â signals that whoever sent it understood UK GDPR obligations well enough to apply pressure at the exact point where regulatory exposure lives. That’s a more sophisticated psychological lever than a generic ransom note, even if the underlying technical claim about Snowflake turns out to be false.
ASOS’s Official Response and Containment Steps
ASOS, which operated across more than 100 markets in October 2026, acknowledged the incident publicly on October 6. The retailer said unauthorized activity involved third-party platforms used to communicate with customers, and that it had restricted access, begun an investigation and notified relevant authorities. On October 8, 2026, ASOS said hackers obtained credentials by impersonating a trusted contact. BleepingComputer reported that the retailer restricted access to the affected communication tools and posted an in-app warning telling customers to disregard the alert and avoid clicking the embedded link. ASOS also issued a direct apology, telling customers, as quoted by TheTab: “We’re sorry that you may have received an unauthorised push notification from ASOS earlier today.”
On the substance of what was exposed, ASOS’s statement, reported by Reuters, People, and BleepingComputer, said: “Basic personal information including name and contact details may have been accessed.” The company added on October 8, 2026 that payment-card data and account passwords were not accessed. That’s a narrower exposure than the headline “HACKED” notification implied, but it’s still a confirmed data-protection incident, not merely a spam message, which is the distinction that matters for ASOS’s regulatory obligations going forward.
What Data May Have Been Exposed â Claims vs. Confirmations
There’s a wide gap between what the attackers claim and what ASOS has confirmed. No outlet in the reporting reviewed, including the BBC and BleepingComputer, has published a verified customer count, and no independently verified stolen data or sample records were reported for the claim attributed to the Xuanye Group. Early accounts described recipients variously as “dozens” or “thousands,” but ASOS has not released an official figure.
| Claim | Attacker’s version | ASOS/Snowflake’s version | Source |
|---|---|---|---|
| Platform compromised | Snowflake instance “fully compromised” | Snowflake: “no compromise” found | BBC |
| Data exposed | Full customer database implied | “Basic personal information including name and contact details” | BleepingComputer, Reuters |
| Payment data | Not specified | Not believed to be impacted | Reuters, People |
| Passwords | Not specified | Not believed to be impacted | Reuters, BleepingComputer |
| Number of customers affected | No figure given | No figure confirmed | BBC, BleepingComputer |
| Delivery method | Via official ASOS app notification | Confirmed; third-party customer-communication platform accessed without authorization | BleepingComputer, Hackread |
That last row is arguably the most important one for anyone running a consumer app. The attackers didn’t need to breach ASOS’s core database to cause panic and a double-digit share price move; they needed access to one marketing or notification vendor sitting on top of it.
Echoes of 2024: The 165-Organization Snowflake Breach Wave
Whether or not Snowflake’s platform is actually involved this time, the name alone revives a specific, well-documented episode. In June 2024, Mandiant and Snowflake jointly disclosed that they had notified “approximately 165 potentially exposed organizations” following a credential-stuffing campaign Mandiant tracked as UNC5537, according to Mandiant’s own threat-intelligence report and corroborating coverage from TechCrunch and The Register. The attackers hadn’t broken into Snowflake’s infrastructure directly; they used stolen customer credentials, mostly accounts without multi-factor authentication, to log into individual customer instances. The platform looks very different today: Snowflake’s release documentation lists version 10.38, covering October 17 to 22, 2026, as its latest listed server release, a build line several generations removed from the infrastructure implicated in that 2024 campaign.
Victims of that 2024 campaign included Ticketmaster, AT&T, Santander, Advance Auto Parts, and Neiman Marcus, among others named in Mandiant’s disclosure and reported by SecurityWeek. TechCrunch noted at the time that only Ticketmaster and LendingTree had publicly confirmed data theft tied to the campaign in its early days, while the rest were still investigating, a pattern that looks familiar in the ASOS case right now. Tech-Insider covered a 2026 echo of that same campaign in detail in its report on the Rockstar Games Snowflake breach, which also referenced the original 165-victim wave.
The pattern distinction matters here. The 2024 campaign was a credential-stuffing operation against real customer accounts with no MFA, confirmed by Mandiant’s forensic work. The ASOS case is an unverified claim inside a push notification, actively disputed by the platform it names, and the 165 figure refers to organizations potentially exposed in 2024, not to confirmed victims of the ASOS incident. Lumping the two together without that caveat would overstate what’s actually confirmed.
How This Compares to Other UK Retail Breaches
ASOS isn’t the first major UK retailer to have a very public cybersecurity moment in the past 18 months. Marks & Spencer, Co-op, and Harrods were all targeted by cyberattacks within weeks of each other in spring 2025, incidents that UK outlets covered extensively at the time and that caused real operational disruption, particularly for M&S’s online ordering systems. What sets the ASOS case apart is the delivery mechanism: rather than disrupting internal systems or forcing a shutdown of online ordering, the attackers used ASOS’s own trusted communication channel to reach customers directly, skipping the retailer entirely as an intermediary for the message.
| Incident | Primary attack surface | Customer-facing impact | Confirmed vs. disputed |
|---|---|---|---|
| 2024 Snowflake campaign (UNC5537) | Stolen credentials, no MFA on customer Snowflake instances | Delayed, via dark-web leak claims | Confirmed by Mandiant/Snowflake |
| UK retail attacks, spring 2025 (M&S, Co-op, Harrods) | Core retail/IT systems | Operational disruption, order delays | Confirmed by companies |
| ASOS, October 2026 | Third-party customer-notification platform | Immediate, via in-app push alert | Partially confirmed; Snowflake link disputed |
Each incident forced a different kind of response. The 2025 retail attacks pushed companies toward supply-chain audits of core IT contractors. The ASOS incident is pushing attention toward a different, less-examined category: the marketing and notification vendors that sit between a retailer and its customers’ phones, which is a far larger and less consistently secured attack surface across the retail sector.
Why Attackers Are Weaponizing Customer Notification Channels
There’s a reason extortion groups increasingly go straight to the customer instead of just posting on a leak forum: it compresses the negotiation timeline. A leak-site listing gives a company days to quietly assess the claim before anyone outside the security team notices. A push notification sent directly to app users turns every recipient into a witness and, often, into free amplification on social media within minutes. ASOS’s 13% share drop happened fast precisely because the proof wasn’t a screenshot on a forum, it was sitting in thousands of customers’ own notification trays.
This also reframes what “third-party risk” means for a consumer retailer. Companies have spent years hardening payment processors and core databases. Far fewer have applied the same scrutiny to the SaaS tools that send push notifications, order confirmations, or marketing emails, even though those tools often sit with broad write access to a brand’s most trusted customer-facing channel. BleepingComputer’s reporting that the attackers accessed “third-party platforms used to communicate with customers” rather than ASOS’s core systems is the detail every retail CISO should be reading closely this week.
What Security Experts and the Companies Involved Are Saying
The public record so far is built almost entirely out of statements from the two companies at the center of the dispute, which makes the gap between their positions the story in itself. Snowflake’s spokesperson told the BBC: “At this time, we can report that we have found no compromise of the Snowflake platform.” That statement, reported via the BBC’s live coverage, is as close to a direct rebuttal as a company gets without naming the attacker outright.
Snowflake followed up with a broader statement reported by Insurance Journal: “We take customer privacy and security very seriously,” adding that “the investigation is ongoing and we will provide further updates as soon as more information becomes available.” Meanwhile, the attackers’ own words, captured by the BBC, remain the only statement from the Xuanye Group on record: “We have fully compromised the Snowflake instance.” ASOS, for its part, kept its customer-facing message simple. As quoted by TheTab, the retailer said: “We’re sorry that you may have received an unauthorised push notification from ASOS earlier today.”
Notably absent from the public record is any independent forensic voice confirming either version, and the latest available reporting, from October 22, 2026, still treats the question of whether ASOS’s Snowflake environment was accessed as unknown. Until a third-party incident-response firm publishes findings, the dispute remains a he-said-she-said between a company with a strong incentive to minimize its exposure and an anonymous group with every incentive to exaggerate its access.
The Regulatory Question: Where Is the ICO?
UK data protection law gives organizations 72 hours to notify the Information Commissioner’s Office after becoming aware of a breach likely to risk individuals’ rights and freedoms. ASOS’s own statement that basic personal information “may have been accessed” would ordinarily start that clock. As of October 7, however, none of the reporting reviewed, including coverage from the BBC, Reuters, BleepingComputer, People, and Hackread, shows a public statement from the ICO confirming it has opened a formal inquiry into the ASOS incident.
That silence doesn’t mean nothing is happening behind the scenes. ICO notifications aren’t typically made public immediately, and the regulator often waits until it has something substantive to say before commenting on an active case. But the absence of a statement this far into the incident, more than 24 hours after ASOS’s own acknowledgment, is itself notable given how quickly the ICO has weighed in on comparable UK retail incidents over the past two years.
Market and Investor Reaction
The financial market side of this story has already been well documented: ASOS shares fell 13% after the hack threat became public, a reaction that reflects just how seriously investors treat a retailer’s data-handling reputation, even before any data has actually surfaced on a leak site. Adding to that is the uncertainty Snowflake’s denial introduces, a denial it first made on October 6, 2026. A confirmed Snowflake-side breach would have at least given ASOS a shared-liability narrative, similar to how AT&T and Ticketmaster could point to Snowflake’s own 2024 disclosure. A denied breach leaves ASOS holding the reputational cost largely on its own, with no corroborating third party to share the blame, at a moment when Snowflake has every reason to protect its own name: the company took Apache Iceberg v3 table upgrades to general availability on October 16, 2026, a day after bringing Postgres data mirroring to general availability on October 15, 2026, both moves that deepen how many enterprises now depend on the platform it insists was never touched.
What Happens Next: Five Predictions
- A revised customer-count disclosure is likely within days. ASOS’s current statement lacks a specific number, and UK GDPR notification timelines typically force a more precise figure to emerge once the forensic review concludes.
- Expect pressure for a formal ICO statement. Given the pattern set by other 2025-2026 UK retail incidents, a regulator comment, even a brief “we are aware and monitoring,” is a near-certainty within the next one to two weeks.
- The Xuanye Group’s authenticity will be challenged. Security researchers will likely scrutinize whether this is a genuinely new crew or a rebrand, especially since Snowflake has already rejected the technical premise of the group’s core claim.
- Retailers will start auditing notification and marketing SaaS vendors. The real lesson for the retail sector isn’t about Snowflake specifically, it’s that customer-communication platforms are an underscrutinized access point, and procurement and security teams are likely to start treating them with the same rigor as payment processors.
- Snowflake will publish a more detailed forensic statement. Given the reputational stakes of being named in a second high-profile retail incident in two years, Snowflake has strong incentive to move from “no compromise found” to a fuller technical explanation once its investigation wraps up.
What ASOS Customers Should Do Right Now
Regardless of which side of the Snowflake dispute turns out to be accurate, the practical advice for ASOS customers doesn’t change much. ASOS itself has told customers not to click the link embedded in the rogue notification, a message BleepingComputer and TheTab both reported. Beyond that, customers who use the same password across multiple retail accounts should treat this as a reminder to use unique passwords and enable any available multi-factor authentication option, the same lesson that applied to the broader surge in data-theft extortion this year. Since ASOS says it doesn’t believe payment data was affected, there’s no immediate need to cancel cards tied to the account, but watching for unusual account activity or phishing attempts referencing the ASOS name over the coming weeks is a reasonable precaution.
The Bigger Picture for Retail Cybersecurity
Step back from the Snowflake dispute and a clearer trend comes into focus: extortion groups are getting better at finding the softest, most customer-visible point in a retailer’s tech stack, and it’s rarely the system a company has spent the most money protecting. The extortion playbook that groups like ShinyHunters have refined throughout 2026 relies less on sophisticated zero-days and more on abusing access to systems that were never designed with extortion scenarios in mind, from CRM platforms to, in this case, an app notification pipeline. Whether or not Xuanye Group turns out to be a serious new threat actor or a short-lived opportunist, the method it used, hijacking a trusted customer channel to generate instant, visible proof of compromise, is cheap, fast, and effective, and other groups will almost certainly copy it.
Frequently Asked Questions
Was ASOS actually hacked?
ASOS has confirmed “unauthorised activity” involving third-party platforms used to communicate with customers, and said basic personal information including names and contact details may have been accessed, according to BleepingComputer and Reuters. It has not confirmed the full scope the attackers claim.
Did Snowflake get breached?
No, according to Snowflake itself. A Snowflake spokesperson told the BBC: “At this time, we can report that we have found no compromise of the Snowflake platform.” This directly contradicts the attackers’ claim.
Who is the Xuanye Group?
Hackread described Xuanye Group as a previously unknown entity that claimed responsibility for the ASOS notification incident. No security researcher cited in current reporting has linked it to a previously documented ransomware or extortion brand.
What data was exposed in the ASOS hack?
ASOS says basic personal information, including names and contact details, may have been accessed. The company says it does not believe payment-card information or account passwords were impacted, per Reuters and BleepingComputer.
How does this compare to the 2024 Snowflake breach wave?
The 2024 campaign, tracked by Mandiant as UNC5537, used stolen credentials to access roughly 165 real Snowflake customer instances, confirmed jointly by Mandiant and Snowflake. The ASOS case is a disputed claim inside a push notification; Snowflake says its platform was not compromised this time.
Has the UK ICO responded to the ASOS hack?
As of October 7, 2026, no public statement from the UK Information Commissioner’s Office has appeared in reporting from the BBC, Reuters, BleepingComputer, People, or Hackread.
Is this linked to ShinyHunters?
No confirmed link has been reported. The claimed attacker identifies itself as the Xuanye Group, a name distinct from ShinyHunters, and no outlet reviewed has connected the two.
Should ASOS customers change their passwords?
It’s a reasonable precaution even though ASOS says it doesn’t believe passwords were impacted. Using a unique password for ASOS and enabling multi-factor authentication where available costs little and closes off a common follow-on attack vector after any data-exposure incident.
